from the look-at-that dept

A potentially big ruling came out of the courtroom of Judge Lucy Koh yesterday, in which she affirmed a magistrate judge's decision to tell the government to get a warrant if it wants to obtain historical location info about certain "target" mobile phones (officially known as "Cell Site Location Info" -- or CSLI). The government sought to use a provision of the Stored Communications Act (a part of ECPA, the Electronic Communications Privacy Act) to demand this info without a warrant -- using a much lower standard: "specific and articulable facts" rather than the all important "probable cause." Judge Koh says that's doesn't pass 4th Amendment muster, relying heavily on the important Supreme Court rulings in the Jones case, involving attaching a GPS device to a car, and the Riley case about searching mobile phones.

Based on the preceding U.S. Supreme Court cases, the following principles are manifest:
(1) an individual’s expectation of privacy is at its pinnacle when government surveillance intrudes
on the home; (2) long-term electronic surveillance by the government implicates an individual’s
expectation of privacy; and (3) location data generated by cell phones, which are ubiquitous in this
day and age, can reveal a wealth of private information about an individual. Applying those
principles to the information sought here by the government, the Court finds that individuals have
an expectation of privacy in the historical CSLI associated with their cell phones, and that such an
expectation is one that society is willing to recognize as reasonable.

This is big. Obviously, the government is likely to appeal, and so as a first pass, this might seem meaningless. We've still got an appeals court (and possibly a rehearing) and a Supreme Court to get to, but as a first ruling, it's a good one. Koh's analysis is pretty thorough. It notes the similarities to both the Jones and Riley cases:

Here, as in Jones, the government seeks permission to track the movement of
individuals—without a warrant—over an extended period of time and by electronic means. CSLI,
like GPS, can provide the government with a “comprehensive record of a person’s public
movements that reflects a wealth of detail about her familial, political, professional, religious, and
sexual associations.” Riley, 134 S. Ct. at 2490 (quoting Jones, 132 S. Ct. at 955 (Sotomayor, J.,
concurring)). With the proliferation of smaller and smaller base stations such as microcells,
picocells, and femtocells—which cover a very specific area, such as one floor of a building, the
waiting room of an office, or a single home, ...—the government is
able to use historical CSLI to track an individual’s past whereabouts with ever increasing
precision. See Riley, 134 S. Ct. at 2490 (explaining that a cell phone’s “[h]istoric location
information . . . can reconstruct someone’s specific movements down to the minute, not only
around town but also within a particular building”). At oral argument, the government agreed that
in some instances CSLI could locate an individual within her home, ... and did not dispute that CSLI will become more precise as the number of cell towers
continues to multiply.... This admission is of constitutional significance because rules
adopted under the Fourth Amendment “must take account of more sophisticated systems that are
already in use or in development.”...

In fact, the information the government seeks here is arguably more invasive of an
individual’s expectation of privacy than the GPS device attached to the defendant’s car in Jones.
This is so for two reasons. First, as the government conceded at the hearing, over the course of
sixty days an individual will invariably enter constitutionally protected areas, such as private
residences.... Tracking a person’s movements inside the home matters for
Fourth Amendment purposes because “private residences are places in which the individual
normally expects privacy free of governmental intrusion not authorized by a warrant, and that
expectation is plainly one that society is prepared to recognize as justifiable.” Karo, 468 U.S. at
714; see also Kyllo, 533 U.S. at 31 (“At the very core of the Fourth Amendment stands the right of
a man to retreat into his own home and there be free from unreasonable governmental intrusion.”
(internal quotation marks omitted)). As one court put it, “Because cellular telephone users tend to
keep their phone on their person or very close by, placing a particular cellular telephone within a
home is essentially the corollary of locating the user within the home.” ....

Second, the government conceded at oral argument that, compared to GPS tracking of a
car, the government will “get more information, more data points, on the cell phone” via historical
CSLI... (“But, yes, of course the person has the phone
more than they have their car, most people at least do, so it gives [the government] more data.”).
Cell phones generate far more location data because, unlike the vehicle in Jones, cell phones
typically accompany the user wherever she goes.... Indeed, according to a survey
cited by the U.S. Supreme Court in Riley, “nearly three-quarters of smart phone users report being
within five feet of their phones most of the time, with 12% admitting that they even use their
phones in the shower.”....

Judge Koh points to some survey data from Pew (sent in by EFF) noting that many, many people consider their location information to be "sensitive information" and, on top of that, the fact that CSLI is generated even if someone turns off the GPS or "location data" features on their phone -- meaning they can't even opt out of generating such information to try to keep it private.

More importantly, Judge Koh takes on the issue of the infamous third party doctrine and the awful Smith v. Maryland precedent, which says you have no expectation of privacy in data held by third parties. To date, the Supreme Court has punted on this issue in the Jones and Riley cases. However, Koh addresses the issue head on, and says the third party doctrine should not apply to phone location data like this. The key issue: in the Smith case, the "information" that was given to the third party was the phone number being dialed. This was information that the caller voluntarily conveyed to the phone company in order to make the call. Judge Koh points out that this information is quite different:

Cell phone users, by contrast, do not “voluntarily convey” their location to the cellular
service provider in the manner contemplated by Miller and Smith. This is especially true when
historical CSLI is generated just because the cell phone is on, such as when cell phone apps are
sending and receiving data in the background or when the cell phone is “pinging” a nearby cell
tower. As the government’s FBI special agent explained, “CSLI for a cellular telephone may still
be generated in the absence of user interaction with a cellular telephone.” .... “For
example,” the special agent continued, CSLI may be generated by “applications that continually
run in the background that send and receive data (e.g. email applications).” ... At oral argument,
the government confirmed that its § 2703(d) application authorizes the government to obtain
historical CSLI generated by such activities.

[....] In so doing, a cell phone
periodically identifies itself to the closest cell tower—not necessarily the closest cell tower
geographically, but the one with the strongest radio signal—as it moves through its network’s
coverage area.... This process, known as “registration” or “pinging,”
facilitates the making and receiving of calls, the sending and receiving of text messages, and the
sending and receiving of cell phone data.... Pinging nearby cell towers is automatic and
occurs whenever the phone is on, without the user’s input or control.... This
sort of pinging happens every seven to nine minutes....

In Miller and Smith, the individual knew with certainty the information that was being
conveyed and the third party to which the conveyance was made. Cell phone users, on the other
hand, enjoy far less certainty with respect to CSLI. CSLI, in contrast to deposit slips or digits on a
telephone, is neither tangible nor visible to a cell phone user. When the telephone user in Smith
received his monthly bill from the phone company, the numbers he dialed would appear.... The CSLI generated by a user’s cell phone makes no such appearance.... Rather, because CSLI is generated automatically whenever a cell tower detects radio
waves from a cell phone, a cell phone user typically does not know that her phone is
communicating with a cell tower, much less the specific cell tower with which her phone is
communicating.... It may be, as the government explained, that a cell phone
connects to “many towers” during the length of a call,... and the tower to which a cell
phone connects is not necessarily the closest one geographically.... Moreover, when
an app on the user’s phone is continually running in the background, ... she may
not be aware that the cell phone in her pocket is generating CSLI in the first place.

And thus, even with the third party doctrine, this information is quite different than that discussed in the Smith v. Maryland case, which involved phone numbers dialed:

In light of the foregoing, the Court concludes that historical CSLI generated via continuously operating apps or automatic pinging does not amount to a voluntary conveyance of
the user’s location twenty-four hours a day for sixty days. Such data, it is clear, may be generated
with far less intent, awareness, or affirmative conduct on the part of the user than what was at
issue in Miller and Smith. Unlike the depositor in Miller who affirmatively conveyed checks and
deposit slips to the bank, or the telephone user in Smith who affirmatively dialed the numbers
recorded by the pen register, a cell phone user may generate historical CSLI simply because her
phone is on and without committing any affirmative act or knowledge that CSLI is being
generated. Smith, for example, never contemplated the disclosure of information while the
landline telephone was not even in use.

This sort of passive generation of CSLI does not amount to a voluntary conveyance under
the third-party doctrine.

Judge Koh notes that this ruling isn't rejecting the ruling in Smith -- rightly noting that only the Supreme Court can determine that it's no longer good law -- but notes that the ruling there is different enough from this one that it does not apply. Ideally, the Supreme Court will get around to rejecting the ridiculous third party doctrine altogether, but if it must stand, a ruling like this is helpful in returning just a bit of 4th Amendment protected privacy to the American public.

from the you-sort-of-won!-what-more-do-you-want? dept

Just as James Clapper's office was officially announcing the death of the bulk phone metadata program (ending November 29th, with three months of post-wind-down wind-down for data analysts), the DOJ was filing a motion in the Second Circuit Court of Appeals basically arguing that its finding that the program was illegal really doesn't matter anymore.

According to the DOJ, there really is no program -- at least if you don't count the six months the NSA has to make the move to the more targeted USA Freedom version. So this discussion about which program isn't authorized by which PATRIOT Act provision is… well, not completely moot, but like pretty much literally weeks away from moot, so why are we wasting our time here [EXASPERATED SIGH].

Plaintiffs’ claims will be moot when the bulk collection of telephony metadata under Section 215 ends on November 29, 2015, though they are not moot right now. On that date, the statutory authority for the Section 215 bulk telephony-metadata program will expire, and the data previously collected and held under that program will not be used in the future for intelligence-gathering or law-enforcement purposes. In the meantime, however, the Court should respect Congress’s decision to create an orderly transition away from the Section 215 bulk telephony-metadata program. Especially in light of Congress’s considered judgment that this program should continue for this limited period, plaintiffs are not entitled to any of the relief they request.

In support of its argument that the court should ignore its own findings and just listen to what the FISA Court said (and what legislators didn't say, but obviously intended), the government points to its own Tumblr post (certainly a historical moment in its own right) detailing the specifics of the end of Section 215.

On July 27, 2015, the Office of the Director of National Intelligence (ODNI) issued a public statement that the NSA has determined that “analytic access to that historical metadata collected under Section 215 . . . will cease on November 29, 2015,” at the end of the transition period. See Statement by ODNI on Retention of Data Collected Under Section 215 of the USA PATRIOT Act, available at http:// icontherecord.tumblr.com/post/125179645313/ statement-by-the-odni-on-retention-of-data (ODNI July 27 Statement). Thus, after that date, no further bulk collection of telephony metadata will take place under the Section 215 program, and the historical telephony metadata will not be used for intelligence or law-enforcement purposes and will not be disseminated.

To sum up: these past abuses should no longer be of concern as the data is going to be flushed (for the most part) within the next nine months. To better enable said data flush, the Second Circuit Court might want to wrap up the ACLU's suit (and hasten the end of the EFF's) so that no data is still being "preserved" past the November 2015 dump point.

To that end, the DOJ constantly reminds the Second Circuit that the FISA Court really has a handle on these sort of things and why don't we just leave it to the pros.

The FISC was right that Congress authorized the Section 215 bulk telephony-metadata program to continue during the six-month transition period. [p. 6]

As the FISC correctly noted, Congress’s decision to delay that ban for six months is a powerful indication that it intended to permit bulk collection in the interim period. [p. 9]

The FISC was thus correct when it observed that “after lengthy public debate, and with crystal clear knowledge of the fact of ongoing bulk collection of call detail records” Congress “chose to allow a 180-day transitional period . . . .” June 29 FISC Op. at 11. This Court need not and should not determine whether Congress “ ‘ratif[ied] the FISA Court’s interpretation of ’ ” Section 215. [p. 11]

This filing, like its Tumblr statement announcing the official end of the collection, emphasizes the single aspect of the Section 215 bulk collections that has been the focus of this litigation and most legislative efforts: phone metadata. The authorization, even in its altered, post-USA Freedom Act form -- provides for much more than just this one type of collection. The DOJ goes so far as to call the USA Freedom Act a "ban" on bulk, untargeted collections, when it actually doesn't go quite that far.

I believe both ACLU and EFF’s phone dragnet client Counsel on American Islamic Relations, had not only standing as clients of dragnetted companies, but probably got swept up in the two-degree dragnet. But CAIR probably has an even stronger case, because it is public that FISC approved a traditional FISA order against CAIR founder Nihad Awad. Any traditional FISA target has always been approved as a RAS seed to check the dragnet, and NSA almost certainly used that more back when Awad was tapped, which continued until 2008. In other words, CAIR has very good reason to suspect the entire organization has been swept up in the dragnet and subjected to all of NSA’s other analytical toys.

EFF, remember, is the one NGO that has a preservation order, which got extended from its earlier NSA lawsuits (like Jewel) to the current dragnet suit. So when I Con the Record says it can’t destroy all the data yet, it’s talking EFF, and by extension, CAIR. So this announcement — in addition to preparing whatever they’ll file to get the Second Circuit off its back — is likely an effort to moot that lawsuit, which in my opinion poses by far the biggest threat of real fireworks about the dragnet (not least because it would easily be shown to violate a prior SCOTUS decision prohibiting the mapping of organizations).

This announcement by Clapper's office, followed shortly thereafter on the same day by the filing of its response in the Second Circuit case, certainly gives the appearance that the NSA has lifted the corner of the rug and is just waiting for the signal to start sweeping any undiscovered abuses -- along with those previously exposed -- under it. That the expiration of the authority and the passage of the USA Freedom Act may have provided it with a better broom is unexpectedly fortuitous.

from the no-hard-truth-left-unhidden dept

A federal judge has ruled the CIA and Defense Department (DOD) do not have to confirm or deny whether they have records on the “factual basis for the killing” of either Samir Khan or Abdulrahman al-Awlaki, who were killed in two separate drone strikes in September and October of 2011.

The heavily-redacted order does contain some good news, however. The presiding judge ordered the Dept. of Defense and the CIA to turn over FOIAed documents to the ACLU that contain "previously acknowledged facts," thus preventing the Dept. of Justice from turning real life into a bizarre fantasy world where previously disclosed information can be treated as though it was still locked up in the agency's "TOP SECRET" digital filing cabinet.

But the obvious downside is this: because the government has been given permission to avoid confirming or denying the existence of the documents the ACLU is seeking, the search for more information on accidental deaths and collateral damage will still consist of issuing speculative FOIA requests, which will then result in more lengthy, expensive litigation.

I'm pretty sure the involved agencies believe they can outlast FOIA requesters, especially if they continue to receive mostly-favorable decisions from judges who place more faith in the government and its assertions about national security than in those who view government secrecy with considerably more skepticism. The problem is that the government has the resources to fight long legal battles. Most FOIA requesters do not.

This decision also further insulates the government from the repercussions of its own actions. By allowing the agencies to neither confirm nor deny the existence of these documents, it gives the government permission to deflect further inquiries into the oversight governing drone strikes -- and what it does when it suspects a strike has killed the wrong people.

If one accepts the government’s claims that Khan and Abdulrahman’s deaths were “accidental,” one at least has to believe the government did some kind of review after the strikes once they recognized two US citizens had been killed. This is what the ACLU suspects.

The ACLU and Center for Constitutional Rights have pursued a lawsuit challenging the constitutionality of the strikes, which killed the three US citizens. And, in this lawsuit, the ACLU has challenged the right of the government to keep information related to their deaths secret.

This sort of information is definitely of the "public interest" variety and should be given more heft when weighed against national security concerns. The American public isn't necessarily supportive of this highly-secret program and considering its complete lack of say in the matter, the least it should be given is the opportunity to more closely examine the accountability process.

Instead, the opinion allows the government to redact much of what it can't Glomar into nonexistence with the most abused FOIA exemption: b(5). Nominally for "deliberative process" documents only, the exemption has expanded to cover almost anything the government doesn't want to (immediately) reveal. About the only way to remove a b(5) exemption is through the courts -- an expensive process with low odds of success.

from the (b)5:-for-when-you-absolutely,-positively-have-to-hide-every-motherfuckin'-d dept

The ACLU is suing the CIA over its withholding of CIA Torture Report-related documents, including the so-called Panetta Review. The CIA, so far, has managed to withhold the requested documents in their entirety, citing multiple FOIA exemptions. The ACLU isn't taking no for an answer and has challenged the CIA's refusal to turn over any of the documents the ACLU has requested. But this effort has now been shut down by the DC District Court.

The decision starts by noting that if the SSCI report (Torture Report) had remained solely in the hands of the Senate, it would have been unobtainable via FOIA requests. The ACLU had argued that its transfer to the CIA has released it from this clearly delineated restriction. ("For purposes of FOIA, the definition of an “agency” specifically excludes Congress, legislative agencies, and other entities within the legislative branch.")

The court finds otherwise:

The Court’s inquiry, therefore, is a streamlined one: do there exist “sufficient indicia of congressional intent to control,” id., the Full SSCI Report? [...] Although this case is no slam dunk for the Government, the Court answers that question in the affirmative.

The decision quotes from a SSCI letter from 2009 referring to the still in-the-works Torture Report.

In its June 2009 letter to the CIA, SSCI expressly stated its intent that the documents it generated during its investigation “remain congressional records in their entirety and disposition,” such that “control over these records, even after the completion of the Committee’s review,” would “lie[] exclusively with the Committee.” June 2, 2009, SSCI Letter, ¶ 6. Making its wishes even more explicit, it continued, “As such, these records are not CIA records under the Freedom of Information Act, or any other law.”

The ACLU pointed out that this letter from 2009 was both outdated and irrelevant to the issue at hand, as it only pertained to the use of documents shared with the Senate by the CIA, rather than the resulting report. The court disagrees, stating that the language in the 2009 letter is broad enough to cover the finished product, rather than just the documents contributing to it. But it also points out the CIA's arguments in defense of its secrecy are also inconsistent.

One final point bears mention. Defendants’ own characterizations of the scope of the letter vary somewhat in their submissions. Compare, e.g., Higgins Decl., ¶ 12 (“One key principle necessary to this inter-branch accommodation . . . was that the materials created by SSCI personnel on [the] segregated shared drive would not become ‘agency records’ even if those documents were stored on a CIA computer system or at a CIA facility.”) (emphasis added), with Def. Reply at 5 (explaining that the language of the June 2009 letter “covers the Full Report” as a “final . . . report[] or other material[] generated by Committee staff or members,” even though it did not reside on the network drive).

The ACLU also argued that Dianne Feinstein's letter from 2010 is a better indicator of whether or not the report and its supporting documents are FOIA-able.

As its pièce de résistance, the ACLU seizes on the December 10, 2014, transmittal letter from Senator Feinstein, claiming it represents “direct evidence of the SSCI’s intentions for the Final Full Report.” Id. That letter, to recap, states:

"[T]he full report should be made available within the CIA and other components of the Executive Branch for use as broadly as appropriate to help make sure that this experience is never repeated. To help achieve this result, I hope you will encourage use of the full report in the future development of CIA training programs, as well as future guidelines and procedures for all Executive Branch employees, as you see fit." December 10, 2014, Feinstein Letter.

“By encouraging the use and dissemination of the Final Full Report among the executive branch, and by leaving to the executive branch the decision as to how ‘broadly’ the report should be used within the agencies,” claims Plaintiff, “SSCI relinquished its control over the document.”

The court rebuts this argument as well. Rejecting the ACLU's "refinement" of the entirety of SSCI-related communication between the Senate and the CIA to a single letter, the court declares that Feinstein's instructions must be considered in context.

The Court, therefore, need not confine its consideration to the moment of transmission. On the contrary, SSCI’s 2009 letter sets the appropriate backdrop against which Senator Feinstein’s 2014 letter can be properly understood.

So teed up, her letter does not evince congressional intent to surrender substantial control over the Full SSCI Report. While it does bestow a certain amount of discretion upon the agencies to determine how broadly to circulate the Report, such discretion is not boundless. Most significantly, the dissemination authorized by the letter is limited to the Executive Branch alone. It plainly does not purport to authorize the agencies to dispose of the Report as they wish – e.g., to the public at large.

The court also adds that Feinstein's statement accompanying the public release of the report summary further declares the documents off-limits -- at least until further notice.

SSCI’s deliberate decision not to publicly release the Full Report, combined with its assertion that it would consider that course of action in the future, serve to further undermine Plaintiff’s theory that Congress intended to relinquish control over the document only days later.

It finds similarly for the "Panetta Report" documents, citing its rejection of Jason Leopold's FOIA request. The CIA continues to assert that these documents are "deliberative" in nature and out of the reach of FOIA requests, despite the fact that what's being deliberated has already been made public (in the summary report) and handed over to the executive and legislative branches (via the full report). The court upheld the CIA's exemption (b)5 declaration, stating that it doesn't matter whether or not portions of the sought documents are in the public domain, but rather that the documents are part of an agency's "deliberative process." (This is why exemption (b)5 is the most-abused FOIA exemption.)

As it had already shot down Leopold's request, the court finds no reason to alter its course, despite some "novel" arguments advanced by the ACLU -- including quoting Sen. Udall's assertion that the Panetta Review is a complete work of critical importance (a "smoking gun") that far exceeds the CIA's portrayal of it as an unfinished pile of somewhat related deliberative works-in-progress. The CIA's motion to dismiss is granted.

With this decision (and many preceding it), government agencies are being given even more reason to declare anything they don't want released "deliberative" and trust the courts to uphold their declarations.

from the huge-win dept

Whoa. In a huge ruling, the Second Circuit appeals court has ruled that the NSA's bulk phone records collection is not authorized by the PATRIOT Act. In other words, for all the debate about the renewal of Section 215 this month, which the government insists enables such bulk collection, this appeals court says "nope." The ruling is important on a number of different points, even though it doesn't touch on the constitutionality of the program. It does make some other key points though. The biggest, as Rep. Jim Sensenbrenner (author of the PATRIOT Act) has said all along is that, contrary to the US government's claims, Section 215 does not authorize the bulk collection of any data.

We hold that the text of § 215 cannot bear the
weight the government asks us to assign to it, and that it does not authorize the
telephone metadata program. We do so comfortably in the full understanding
that if Congress chooses to authorize such a far‐reaching and unprecedented
program, it has every opportunity to do so, and to do so unambiguously. Until
such time as it does so, however, we decline to deviate from widely accepted
interpretations of well‐established legal standards.

The actual ruling is overturning a district court ruling that had previously tossed out a challenge to the Constitutionality of the bulk metadata program by the ACLU. This ruling reinstates that case and sends it back to the lower court. As part of that, the court doesn't yet rule on the constitutionality of the overall program, but rather just notes that from the plain reading of Section 215, it does not mean that it authorized the government to collect such a massive trove of phone records.

The other key point in the ruling is on the question of "standing." The DOJ regularly claims that people cannot challenge these programs unless they have specific evidence that they were spied on under the program. Plenty of cases have been thrown out after plaintiffs couldn't prove that the government had directly applied the program to their information, and thus the courts said they lacked standing. In this case, at least, the district court had found that the ACLU had standing, and the appeals court reconfirms that. But here's the key point: the court notes that merely the collection of the data is enough to show standing. This is in contrast to the DOJ's attempt to claim that the collection doesn't matter -- it's only if the government then looks at the data. The court disagrees, reminding the DOJ that the Fourth Amendment applies to not just "searches" but also "seizures," and the data collection is a seizure:

Appellants in this case have, despite those substantial hurdles, established
standing to sue, as the district court correctly held. Appellants here need not
speculate that the government has collected, or may in the future collect, their call
records. To the contrary, the government’s own orders demonstrate that
appellants’ call records are indeed among those collected as part of the telephone
metadata program. Nor has the government disputed that claim. It argues
instead that any alleged injuries here depend on the government’s reviewing the
information collected, and that appellants have not shown anything more than a
“speculative prospect that their telephone numbers would ever be used as a
selector to query, or be included in the results of queries of, the telephony
metadata.”

But the government’s argument misapprehends what is required to
establish standing in a case such as this one. Appellants challenge the telephone
metadata program as a whole, alleging injury from the very collection of their
telephone metadata. And, as the district court observed, it is not disputed that
the government collected telephone metadata associated with the appellants’
telephone calls. The Fourth Amendment protects against unreasonable searches
and seizures. Appellants contend that the collection of their metadata exceeds the
scope of what is authorized by § 215 and constitutes a Fourth Amendment
search. We think such collection is more appropriately challenged, at least from a
standing perspective, as a seizure rather than as a search. Whether or not such
claims prevail on the merits, appellants surely have standing to allege injury
from the collection, and maintenance in a government database, of records
relating to them. “[A] violation of the [Fourth] Amendment is fully
accomplished at the time of an unreasonable governmental intrusion.” United
States v. Verdugo‐Urquidez, 494 U.S. 259, 264 (1990) (internal quotation marks
omitted). If the telephone metadata program is unlawful, appellants have
suffered a concrete and particularized injury fairly traceable to the challenged
program and redressable by a favorable ruling.

That's a very important finding and one that I imagine will also be quite useful in challenging other aspects of NSA surveillance.

Furthermore, the court notes that even beyond the "seizure" aspect, the government is clearly doing "searches" as well:

The government admits that, when it queries its database, its
computers search all of the material stored in the database in order to identify
records that match the search term. In doing so, it necessarily searches
appellants’ records electronically, even if such a search does not return
appellants’ records for close review by a human agent. There is no question that
an equivalent manual review of the records, in search of connections to a suspect
person or telephone, would confer standing even on the government’s analysis.
That the search is conducted by a machine might lessen the intrusion, but does
not deprive appellants of standing to object to the collection and review of their
data.

The DOJ tried to rely on the big ruling against Amnesty International at the Supreme Court a couple of years ago, noting that that was dismissed because the record collection there was speculative. Yet, in this case, that's not true:

Here, appellants’ alleged injury requires no speculation whatsoever as to
how events will unfold under § 215 – appellants’ records (among those of
numerous others) have been targeted for seizure by the government; the
government has used the challenged statute to effect that seizure; the orders have
been approved by the FISC; and the records have been collected. Amnesty
International’s “speculative chain of possibilities” is, in this context, a reality.

The court also finds that there's standing on First Amendment grounds, thanks to the chilling effects of surveillance:

Appellants likewise have standing to assert a First Amendment violation.
Appellants contend that their First Amendment associational rights are being
violated, both directly and through a “chilling effect” on clients and donors. The
Supreme Court has long recognized that an organization can assert associational
privacy rights on behalf of its members, stating that “[i]t is hardly a novel
perception that compelled disclosure of affiliation with groups engaged in
advocacy may constitute . . . a restraint on freedom of association.”

There's a lot more in the ruling as well, including a clear rejection of the idea that the program and the orders of the FISA court to collect this data are somehow "not reviewable" by the judicial system. The DOJ says that because the court orders are secret, that means there can't be judicial review. The 2nd Circuit's response is basically, "you're really undermining your own case here":

Upon closer analysis, however, that argument fails. The government has
pointed to no affirmative evidence, whether “clear and convincing” or “fairly
discernible,” that suggests that Congress intended to preclude judicial review.
Indeed, the government’s argument from secrecy suggests that Congress did not
contemplate a situation in which targets of § 215 orders would become aware of
those orders on anything resembling the scale that they now have. That
revelation, of course, came to pass only because of an unprecedented leak of
classified information. That Congress may not have anticipated that individuals
like appellants, whose communications were targeted by § 215 orders, would
become aware of the orders, and thus be in a position to seek judicial review, is
not evidence that Congress affirmatively decided to revoke the right to judicial
review otherwise provided by the APA in the event the orders were publicly
revealed.

And then there's this lovely line:

In short, the government relies on bits and shards of inapplicable statutes,
inconclusive legislative history, and inferences from silence...

Hey, DOJ/NSA: this court isn't buying what you're selling.

Next up, the DOJ trots out a standard talking point, about how collecting all this info is just like a grand jury subpoena. Once again, the court points out that's ridiculous, focusing on the fact that Section 215 requires the information to be "relevant." We've discussed in the past how the NSA has reinterpreted relevance to mean "might be useful at some point in the future." And the court explicitly rejects that:

The records demanded are all‐encompassing; the government does not even
suggest that all of the records sought, or even necessarily any of them, are
relevant to any specific defined inquiry. Rather, the parties ask the Court to
decide whether § 215 authorizes the “creation of a historical repository of
information that bulk aggregation of the metadata allows,”....
because bulk collection to create such a repository is “necessary to the application
of certain analytic techniques,” ... That is not the language in
which grand jury subpoenas are traditionally discussed.

Thus, the government takes the position that the metadata collected – a
vast amount of which does not contain directly “relevant” information, as the
government concedes – are nevertheless “relevant” because they may allow the
NSA, at some unknown time in the future, utilizing its ability to sift through the
trove of irrelevant data it has collected up to that point, to identify information
that is relevant. We agree with appellants that such an expansive concept of
“relevance” is unprecedented and unwarranted.

And further on that point:

The
government has not attempted to identify to what particular “authorized
investigation” the bulk metadata of virtually all Americans’ phone calls are
relevant.... Put another way, the government effectively argues
that there is only one enormous “anti‐terrorism” investigation, and that any
records that might ever be of use in developing any aspect of that investigation
are relevant to the overall counterterrorism effort.

And, as the court notes, that doesn't just redefine "relevant" -- it reads it right out of the law:

The government’s approach essentially reads the “authorized
investigation” language out of the statute. Indeed, the government’s
information‐gathering under the telephone metadata program is inconsistent
with the very concept of an “investigation.” To “investigate” something,
according to the Oxford English Dictionary, is “[t]o search or inquire into; to
examine (a matter) systematically or in detail; to make an inquiry or examination
into.” 8 Oxford English Dictionary 47 (2d ed. 2001). Section 215’s language thus
contemplates the specificity of a particular investigation – not the general
counterterrorism intelligence efforts of the United States government. But the
records in question here are not sought, at least in the first instance, because the
government plans to examine them in connection with a “systematic
examination” of anything at all; the records are simply stored and kept in reserve
until such time as some particular investigation, in the sense in which that word
is traditionally used in connection with legislative, administrative, or criminal
inquiries, is undertaken. Only at that point are any of the stored records
examined. The records sought are not even asserted to be relevant to any ongoing
“systematic examination” of any particular suspect, incident, or group;
they are relevant, in the government’s view, because there might at some future
point be a need or desire to search them in connection with a hypothetical future
inquiry.

The court regularly cites the PCLOB report that found the Section 215 program unconstitutional, and seems to have clearly understood the deeper issues with this program. While it falls short of ordering the program to stop (noting that the program is set to end at the end of this month anyway), this ruling is pretty suggestive of how the court might eventually rule on the program's constitutionality if it returns.

Oh, and how can we leave out this tidbit on "secret law":

Congress cannot reasonably be said to have ratified a program of which
many members of Congress – and all members of the public – were not aware.

And it totally rejects the usual NSA defenders' stance that it wasn't secret because members of Congress could have found out about the program if they took significant steps. Not enough, the court says:

In
2010, the Senate and House Intelligence Committees requested that the Executive
Branch provide all members of Congress access to information about the
program before the reauthorization vote. In response, the Executive Branch
provided the Intelligence Committee chairs with a classified paper on the
program, which was then made available to members of Congress. That
availability, however, was limited in a number of ways. First, the briefing papers
could only be viewed in secure locations, for a limited time period and under a
number of restrictions.... The government does not
dispute appellants’ assertion that members of Congress could not bring staff with
them when they went to read the briefing papers, nor discuss the program with
their staff. And, of course, no public debate on the program took place. In 2011,
briefing papers were also provided to the Intelligence Committees, but only the
Senate Committee shared the papers with other members of that body who were
not committee members. The House Intelligence Committee did not share the
papers at all with non‐members, leaving the non‐committee Representatives in
the dark as to the program.

We had highlighted Rep. Mike Rogers (then head of the House Intelligence Committee) for failing to make the documents available, and it's nice to see the court pick up on that.

While this doesn't go all the way to ending the program, this is a huge ruling from an important appeals court. This issue will still have to play out for years in other courts and eventually the Supreme Court, but today's ruling by this court is a huge victory for the 4th Amendment, even if the court didn't go all the way there in its analysis.

Each version has been tweaked to comply with local recording laws and presumably more versions are on the way. The Mobile Justice app also provides a handy list of rights citizens have when interacting with law enforcement (subject to law enforcement recognition of those rights, of course) as well as incident forms that can be filled out post-interaction to give the ACLU more detail on the recording itself.

Inarguably, it has been footage obtained by citizens that has blown the lid off police misconduct in this country -- ranging from seemingly routine harassment of camera-wielding citizens to incidents like the death of Walter Scott at the hands of South Carolina police officer Michael Slager, who shot him in the back as he was running away.

If your local ACLU chapter hasn't put together an app to automatically archive recordings of law enforcement interactions, there's another app on the way that will give anyone the ability to capture footage and ensure that, not only will it survive attempts to destroy evidence, but that it will possibly be seen by others as the event unfolds.

[O]ver the course of the weekend, developer Marinos Bernitsas demoed an app that immediately begins recording live audio and video as soon as you tap the app’s icon, but doesn’t actually display the video stream being recorded on the smartphone’s screen.

Meanwhile, instead of having the stream sent out to the public via social networks like Twitter, only designated contacts you’ve previously configured in the app’s settings are alerted to the incident via phone calls and text messages.

Unlike the ACLU's app, Bernitsas' program isn't specifically aimed at police accountability. It's also meant to act as a form of protection against any potentially dangerous interaction. Because it hasn't been crafted with an eye on local recording laws, there's a chance that footage captured could result in charges being brought against the person recording and streaming the incident.

It does have two advantages over the ACLU's app: First off, the app doesn't need to be opened to initiate a recording. Secondly, anyone who grabs the phone will have little clue they're being recorded. The only indicator that anything out of the normal is happening is a red banner across the top of the screen, which may look like nothing more than phone UI customization. The app also makes it possible to capture and stream recordings in areas where coverage is less-than-optimal.

What’s also clever about the app is that even if the user loses their Internet connection, Witness will record video in 10-second chunks and store them locally on the end user’s iPhone. When their connection returns, that video is uploaded to the server.

With the footage going to any contacts the user chooses rather than a neutral party only interested in certain incidents and interactions (like the ACLU), this app holds potential for abuse. One could easily "repurpose" this public safety app to stream sexual encounters, private conversations, etc.

The upside of this downside is that doing so will violate many states' wiretapping laws, which would provide for prosecution of those who use this app for purposes other than what was intended. That the perpetrator creates his or her own damning evidence is helpful and one would imagine captured footage (if still stored at the pass through point) could easily be obtained from Witness' servers with a subpoena. The ACLU notes that footage sent to it is also potentially accessible to law enforcement via subpoenas or other court orders, but does point out that it will fight these requests, rather than simply hand over whatever's requested.

from the a-place-between-bureaucracy-and-secrecy-we-call...-the-The-Twilight-Zone dept

The DOJ's Office of Legal Counsel (OLC) is still trying to keep its memos related to extrajudicial drone killings a secret. The push for secrecy isn't surprising. The surprising part is how much the DOJ continues to fight this lost battle.

Quick recap: the New York Times and ACLU sued the DOJ in an FOIA suit for the release of the OLC's drone-killing memo. The DOJ, of course, maintained it needed to be kept secret for national security reasons and because it was "legal advice," something lying outside the confines of the FOIA law.

The district court saw things differently, mainly because the government -- through officials named and unnamed -- had openly discussed the contents of this memo several times. The government had also confirmed drone targets, drone operation areas and engaged in what the court referred to as "an extensive public relations campaign" to convince the public of the "rightness" of its killer drone program.

So, the court ordered the release of the memo. And then ordered the release of other, similar memos. The DOJ obviously wasn't happy with this decision, but its officials' decision to talk up the legality of drone killing over a period of several years undercut its arguments that the memos were too "secret" to be publicly disclosed.

In a footnote, the government provides this take on the court’s publication of the July 2010 OLC memo (which the government calls the “OLC-DOD Memorandum”):

For purposes of preserving its argument for potential further review, the government respectfully notes its disagreement with this Court's prior ruling that the government has officially disclosed and waived privilege for certain legal analysis contained in the OLC-DOD Memorandum. As set forth in the government's briefs in the earlier appeal, the public disclosures and statements relied on by the plaintiffs did not meet the standard for official disclosure or waiver of applicable privileges. We further note that the Court' s release of the OLC-DOD Memorandum and its order compelling disclosure by the government of additional information would not themselves constitute an independent official disclosure or waiver by the government that would strip protection from otherwise exempt information and material.

As Jaffer notes, the first two sentences have arrived too late to serve any purpose for the DOJ. It had a chance to petition the Supreme Court on this ordered disclosure, but that window open and closed without the DOJ taking any action. The last sentence, however, is where the DOJ heads right off the rails -- at least in terms of logic or credibility.

But it’s the last sentence of the footnote that is truly remarkable — unreal, one might even say. Sure, the government says, the Second Circuit published the July 2010 memo, and sure, it published the memo after having concluded that the government had officially acknowledged the memo’s contents, and after the government declined to file a petition for certiorari to the Supreme Court. But so what?, the government says. We don’t consider the Second Circuit’s publication of the memo to have been an official disclosure. As far as we’re concerned, the government says, the memo is still secret.

Yes. The government is arguing that even though documents have been disclosed thanks to a court order, they haven't been disclosed because the DOJ didn't want them disclosed. That's the argument. Because the DOJ decide to do it itself, it may as well have never happened. Those requesting copies of this document in the future will be denied, even though the document has already been made public.

When government agencies fight for secrecy, logic is immediately sent to the front line of the battlefield to die a swift and brutal death. We've seen this sort of behavior far too frequently, whether it's the government ordering employees not to view leaked documents because they're somehow still "secret" or agencies withholding/redacting documents that have already been made public. Over-classification and default secrecy has brought the US government into the realm of surrealism... or at least, more so.

This agreement between the FBI and the Erie County (NY) Sheriff's Department is even more restrictive. It opens up with the FBI repeating one of its lies in hopes of making the highly-restrictive agreement following it seem less like federal bullying and more like just one of those unfortunate byproducts of pesky regulation.

Consistent with the conditions on the equipment authorization granted to Harris Corporation by the Federal Communications Commission (FCC), state and local law enforcement agencies must coordinate with the FBI to complete this non-disclosure agreement prior to the acquisition and use of the equipment/technology authorized by the FCC authorization.

This paragraph is apparently included in every FBI/Stingray agreement and, according to the FCC, it's all a bunch of BS. The FCC may require coordination with the FBI prior to the purchase of Stingray equipment, but it does NOT require the signing of a non-disclosure agreement. Here's its reply to an FOIA requester seeking the text of this supposed FCC requirement.

We do not require that state and local law enforcement agencies have to complete one or more non-disclosure agreements with the Federal Bureau of Investigation prior to acquisition and/or use of the authorized equipment. We have no documents responsive to your request.

So, the FBI opens with a lie, and then moves on to instructing law enforcement agencies to lie about their Stingray usage... to damn near everybody.

In order to ensure that such collection equipment/technology continues to be available for use by the law enforcement community, the equipment/technology and any information related to its functions, operation, and use shall be protected from potential compromise by precluding disclosure of this information to the public in any manner including but not limited to: in press releases, in court, during judicial hearings, or during other public forums or proceedings.

The government wants law enforcement agencies to lie to the courts -- which includes lying to judges, prosecutors and defendants. Everyone is included. This is made even more explicit a few paragraphs later.

The Erie County Sheriff's Office shall not, in any civil or criminal proceeding, use or provide any information concerning the Harris Corporation wireless collection equipment/technology… beyond the evidentiary results obtained through the use of the equipment/technology including, but not limited to, during pre-trial matters, in search warrants and related affidavits, in discovery, in response to court ordered disclosure, in other affidavits, in grand jury hearings, in the State's case-in-chief, rebuttal, or on appeal, or in testimony in any phase of civil or criminal trial, without the prior written approval of the FBI.

In short: parallel construction. The Sheriff's Office can hand over the results of Stingray collections, but not divulge how it arrived at these results. If it's going to deploy a Stingray, it either needs to do it without a warrant, or mislead the judge on its search techniques when applying for one.

When not lying to judges, the Sheriff's Office will need to lie to defendants and their counsel. Most incredibly, the FBI instructs the law enforcement agency to directly disobey court orders, if it would mean turning over Stingray information.

If any of this seems unavoidable, our nation's top law enforcement agency encourages its colleagues to toss out criminal prosecutions rather than risk exposing Harris Technology's equipment.

In addition, the Erie County Sheriff's Office will, at the request of the FBI, seek dismissal of the case in lieu of using, or providing, or allowing others to use or provide, any information concerning the Harris Corporation wireless collection equipment/technology [...] if using or providing such information would potentially or actually compromise the equipment/technology.

With one caveat…

This point supposes that the agency has some control or influence over the prosecutorial process.

But what a caveat. This is the FBI stating that it assumes any law enforcement agency it enters into this agreement with can easily push prosecutors to drop cases. It naturally follows that this sort of influence would also allow law enforcement agencies to push questionable prosecutions forward, if so inclined.

If the law enforcement agency doesn't have that kind of pull, the FBI suggests they make rogue prosecutors sign on the dotted line as well.

Where such is not the case, or is limited so as to be inconsequential, it is the FBI's expectation that the law enforcement agency identify the applicable prosecuting agency, or agencies, for inclusion in this agreement.

Howard said the machines are used under "judicial review" in all criminal matters.

Well, obviously not. And for that matter, the Sheriff's Office isn't performing much oversight on its own. The NYCLU requested several more Stingray-related documents, including department policies, warrant applications, agreements with communications providers and records concerning the technology's use in investigations. None of these requested documents were withheld. They simply did not exist. The NYCLU sees this as extremely odd:

This leaves us puzzled. Either the $200,000 device is just sitting around somewhere without being used or the agency is using the device without creating and maintaining records.

The latter is more probable, especially in light of the FBI's restrictive non-disclosure agreement. There's no better way to avoid violating that agreement than simply not creating any records that might somehow find their way to the many venues the FBI has listed as off-limits.

What it all boils down to is this: the FBI believes it is more important to protect law enforcement technology than protect the public. It says toss out prosecutions if it might compromise Stingray specifics and actively withhold information from every other participant in the justice system -- from defendants seeking information in discovery all the way up to every judge, at every level, presiding over these cases. The first potentially puts dangerous criminals right back out on the street. The latter guts the protections built into the system. Neither of these are done in the public's interest, and as far as these documents go, the public is way, way down on the FBI's list of priorities. The same goes for law enforcement agencies that willingly sign these agreements.

from the finally,-a-victory dept

For quite some time now, we've been covering how various law enforcement agencies have been using "Stingray" (or similar) cell tower spoofing devices to track the public. Beyond the questionable Constitutionality of such mass surveillance techniques, what's been really quite incredible is the level of secrecy surrounding such devices. We've written about how the US Marshals have "intervened" in various court cases to hide info about the use of Stingrays -- and even telling local law enforcement to lie about their use of the devices. We've written about law enforcement officials claiming "terrorism" as the reason for needing Stingrays, but then using them for everyday law enforcement. We've written about the company that makes Stingrays, Harris Corp., forcing police to sign non-disclosure agreements barring them from revealing any info about their use. It also appears that Harris Corp. misled the FCC to receive approval for its mobile tower spoofing capabilities. Some police departments have even withdrawn evidence rather than talk about their use of Stingrays.

Thankfully, there's been growing concern about these devices. Congress has been investigating and now it appears at least some courts are getting skeptical about the use of Stingrays. The New York Civil Liberties Union (NYCLU) has highlighted that a judge in one of its cases has ordered the Erie County Sheriff's Office to reveal information to the public about its Stingray operations. The full ruling [pdf] is worth reading. While denying the NYCLU's claim that the Sheriff's Office didn't conduct a thorough search as required, the judge is not at all impressed by the redactions in the documents that were released:

The purchase orders should have been disclosed in their entirety, without redaction of the various words, phrases, and figures thus far withheld. The purchase orders (and more particularly the redacted words, phrases, and prices), were not "compiled for law enforcement purposes" in the sense meant by the statute but, even if they were, their disclosure would not: "interfere with law enforcement investigations or judicial proceedings"; "identify a confidential source or disclose confidential information relating to a criminal investigation," meaning a particular ongoing one; or "reveal [non-'routine'] criminal investigative techniques or procedures, meaning techniques a knowledge of which would permit a miscreant to evade detection, frustrate a pending or threatened investigation, or construct a defense to impede a prosecution.... Further, the purchase orders (or, more precisely, the information redacted therefrom), although clearly constituting inter-agency materials" (the other agency involved was Erie County and its Office of the Comptroller), amount entirely to "instructions to staff that affect the public".... Indeed, the instructions set forth in the purchase orders—'in essence, "Pay this bill of this vendor for this item purchased by the Sheriff's Office at this price"—was and is of quintessentially compelling interest to and of undeniable impact upon the taxpaying public.

Finally, the Court finds that the purchase orders, and particularly the matters redacted therefrom, are not "specifically exempted from disclosure by state or federal statute" .... The Court rejects respondent's arguments that the disclosure sought here would, if made, violate a particular federal statute, regulatory scheme, and executive order forbidding (and indeed criminalizing) the export of certain sensitive technology without government license or the illicit revelation of sensitive information about such sensitive technology to foreign nationals. The Court instead is convinced by petitioner's argument that the disclosure of public records pursuant to New York's Freedom of Information Law and the within judicial directive -- even records concerning respondent's ownership and use of a cell site simulator device -- does not amount to the actual export of such arms, munitions, or defense technology. Further, the Court is satisfied by showing on this record that petitioner, a New York not-for-profit corporation, is not a "foreign person," meaning that the disclosures sought by it pursuant to FOIL would not in fact run afoul of related federal legal restrictions on the revelation of sensitive technical data about export-restricted arms or technology.

Oh, as for the non-disclosure agreement with Harris Corp.? The judge notes that a non-disclosure agreement is not a federal regulation:

At the outset, the Court notes its agreement with petitioner's observation that the FBI-drafted non-disclosure agreement is not itself a federal statute specifically exempting anything from disclosure....

In fact, later in the order, the court says that the non-disclosure agreement itself should be disclosed:

Likewise, the Court concludes that this public record ought to have been disclosed in its
entirety. As indicated, the agreement was entered into between the FBI and respondent as an
apparent pre-condition of respondent's being allowed to acquire and use the cell site simulator.
The gist of the letter is not a recitation of the technological capabilities of the device or even the
"hows" and "whens" or the advantages of its use for law enforcement purposes, but rather
simply the need for the Sheriff's Office to avoid disclosing the existence, the technological
capabilities, or any use of the device to anyone, lest "individuals who are the subject of
investigation ... employ countermeasures to avoid detection," thereby endangering the lives
and safety of law enforcement officers and others and compromising criminal law enforcement
efforts as well as national security. The Court has no difficulty in concluding that the agreement
(or, more precisely, each redacted-at-length passage of it) was not "compiled for law
enforcement purposes" in the sense meant by the statute....
Again, even if it was, the Court would conclude that the disclosure of the non-disclosure
agreement would not thwart or prejudice any particular ongoing law enforcement investigation
or pending prosecution.... Nor, the Court concludes,
would the disclosure of the non-disclosure agreement "identify a confidential source or disclose
confidential information relating to a criminal investigation," again meaning a specific ongoing
one, or "reveal" other than "routine" "criminal investigative techniques or procedures"....

There's a lot more, including other documents, and all of that leads the judge to also grant attorney's fees to the NYCLU. It will be interesting to see if the Sherriff's Office challenges this, but it's a pretty complete win for transparency in an area that law enforcement has been trying to keep totally secret for quite some time now.

from the Get-a-job,-terrorist! dept

Say what you will about the internet, but the nation's best conspiracy theorists are employed by the US government. A case involving five individuals who ended up in DHS Suspicious Activity Reports (SARs) is being allowed to move forward. What's remarkable about the lawsuit's allegations is how little it takes to find yourself on the receiving end of extra surveillance and attention.

At the heart of the lawsuit are the SARs themselves -- the paperwork generated with the assistance of "see something, say something" tips from civilians, anything law enforcement/security guards consider to be a "bit off," and the many scattered DHS Fusion Centers' desire to appear useful and fundable.

Lead plaintiff Wiley Gill is a white man who converted to Islam as a student at California State University, Chico, and he drew the attention of the Chico Police Department in May 2012. (Chico is about 180 miles due north of San Francisco.) According to the SAR about Gill, the officer entered Gill’s residence in response to an apparent domestic violence incident (Gill was home alone). The officer then saw on a webpage “titled something similar to ‘Games that fly under the radar’" on Gill’s computer.

"Coupled with the fact he is unemployed, appears to shun law enforcement contact, has potential access to flight simulators via the Internet which he tried to minimize is worthy of note," the SAR, entitled "Suspicious Male Subject in Possession of Flight Simulator Game," concludes.

Unemployed. Doesn't hang out with cops. Plays games and uses the internet. All inherently suspicious because of this tenuous thread: the 9/11 terrorists used flight simulators to train for their attacks. (The SAR guidelines warn that "acquisition of expertise" related to "aviation activity" is suspicious enough to be awarded a capital "S.") Had the Chico Police Dept. bothered to toss a little respect the Fourth Amendment's way, Gill would likely be nothing more than just some guy looking for a job rather than currently involved in a federal civil rights lawsuit over government surveillance.

This tiny bit of unrelated "data" was gathered by the Chico PD, which entered Gill's residence without a warrant or his consent. According to the lawsuit filed by the ACLU, the "domestic violence call" that predicated the search of Gill's residence was likely bogus and only used as justification to search a residence the CPD planned to search anyway. For the better part of two years, Gill had several previous "interactions" with Chico police officers, almost all of them based solely on his appearance ("full beard and traditional garb," "pious demeanor") and religious activities.

Gill did nothing more than "look Muslim" and play videogames. Other plaintiffs did little more than commit photography.

Internationally-renowned photographer (and former Sara Lee/Levi's executive), James Prigoff, became the subject of a Suspicious Activity Report for trying to take photographs of something that has been previously photographed hundreds of times without incident: the "Rainbow Swash" painting that adorns a Boston oil refinery's storage tank. Prigoff was approached by the company's security guards and told he couldn't photograph the oft-photographed storage tank. Despite leaving and providing no contact information, Prigoff was visited by a member of the FBI's Joint Terrorism Task Force shortly after returning to his home in Sacramento.

Plaintiff Aaron Conklin, a graphic design student, was approached by sheriff's deputies while photographing a refinery. He was told he would be put on a "NSA watchlist."

Sometimes, all it takes to appear suspicious enough to report is to stay in the same area for an indeterminate amount of time. Another plaintiff, Tariq Razak, was described by the reporting agency as "surveying entry/exit points" of the Santa Ana Train Depot before leaving with a woman wearing "a white burka head dress." In reality, he was really waiting for mother ("white burka"), who was using the restroom.

Khaled Ibrahim is a U.S. citizen of Egyptian descent who works for a computer network consulting and service company in Silicon Valley, California. Mr. Ibrahim is the subject of a SAR that the ACLU of Northern California obtained through a Public Records Act request. The SAR describes a “[s]uspicious attempt to purchase large number of computers.” Mr. Ibrahim had attempted to make a bulk purchase of computers from Best Buy in his capacity as a purchasing agent for his company.

The government's ideas of what might be terrorist-related activity continues to expand. And even as the DHS plumbs the depths of absurdity with its SARs, the real terrorists remain unaffected. As the ACLU notes in its lawsuit on behalf of the five plaintiffs, the GAO itself has called the program worthless, noting that it has produced nothing in the way of "results-oriented outcomes" (arrests, indictments, thwarted attacks) but has done plenty of damage to Americans' civil liberties.

But the DHS clearly wants to continue violating rights while producing no results. The government moved to dismiss this lawsuit, claiming none of the plaintiffs can prove a "legally cognizable injury" and attempted to put the blame back on the shoulders of local law enforcement agencies. This didn't sit well with Judge Richard Seeborg.

Defendants primarily frame their challenge to plaintiffs’ standing as a purported failure to allege facts showing causation and redressability. Defendants’ argument characterizes plaintiffs’ supposed injuries as arising, if at all, primarily from the actions of the “front line” state and local law enforcement authorities. Defendants contend plaintiffs have not alleged, and credibly cannot, that the scrutiny they purportedly received from state and local police, or even from private security personnel, was the result of the challenged protocols or other conduct of defendants.

The allegations of the complaint, however, show that the gravamen of the alleged injuries lie not in actions of “front line” authorities standing alone, but in the fact that those authorities, pursuant to the guidance and training provided by defendants, submit SAR reports under criteria and circumstances that are allegedly inconsistent with legal principles and policies embodied in other law. Plaintiffs’ cognizable challenge is not to the conduct of law enforcement or private security officers during the alleged encounters per se, although there is at least some implication that plaintiffs believe Defendants’ Standards lead front line personnel to overreach even at the point of making initial observations. Plaintiffs are claiming injury from what occurs AFTER the encounters, pursuant to the Standards. As such, defendants’ contentions as to causality and redressability both fail.

The harms plaintiffs seek to remedy arise directly from the existence of Defendants’ Standards. If plaintiffs can show those standards violate the APA, they will be declared invalid.

While invoking causality and redressability as the main purported shortcomings of plaintiffs’ standing, defendants also imply that merely being the subject of an SAR, in the national database, should not be deemed a cognizable injury. In light of the privacy and reputational interests involved, however, this argument is not tenable.

The lawsuit will move forward, dragging along with it the tattered reputation of the DHS and its GAO-condemned "Fusion Centers." When it takes little more than a religious belief and a browser window containing details on flight sim software to raise someone to the level of "terrorist," the underlying system is not only broken, but swiftly becoming an easy-to-use tool for racial and religious profiling. And when the fear of terrorist attacks is used as a crutch to shut down First Amendment activity, the government itself has gone as far off the rails as those who remain convinced the 9/11 attacks were an inside job. They both gather around the same rally point -- the smoking ruins of a terrorist attack -- and see nothing in their fellow citizens but enemies on the verge of violence.